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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3 GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



This document specifies the signalling procedures for handling the mobility of a UE between 3 GPP Wireless Local 
Area Network Interworking (I-WLAN) and GPRS systems. 

The present document is applicable to the User Equipment (UE) and the network nodes supporting mobility between 
3GPP I-WLAN and GPRS systems. 

In addition, the present document specifies the procedures used between the UE and the network nodes for the attach 
and the detach cases. It also specifies how the UE performs handover when moving from 3 GPP I-WLAN to GPRS 
systems and vice- versa. 

This document is based on DSMIPv6 procedures specified in 3GPP TS 24.303 [3] and will specify additional details 
specific to the 3 GPP I-WLAN and GPRS systems in the context of mobility. 
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document. 
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a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 
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packet based services and Packet Data Networks (PDN)". 

[7] 3GPP TS 29.161: "Interworking between the PubHc Land Mobile Network (PLMN) supporting 

packet based services with Wireless Local Area Network (WLAN) Access and Packet Data 
Networks (PDN)". 

[8] IETF RFC 4877 (April 2007): "Mobile IPv6 Operation with IKEv2 and the Revised IPsec 
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for dual stack Hosts and Routers (DSMIPv6)". 

Editor's note: The above document cannot be formally referenced until it is published as an RFC. 

[II] IETF RFC 3776 (June 2004): "Using IPsec to Protect Mobile IPv6 SignaUng Between Mobile 
Nodes and Home Agents". 

[12] IETF RFC 3775 (June 2004): "Mobility Support in IPv6". 
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[14] 3GPP TS 33.402: "3GPP System Architecture Evolution (SAE); Security aspects of non-3GPP 

accesses". 

[15] Void. 

[16] 3GPP TS 29.282: "Mobile IPv6 vendor specific option format and usage within 3GPP". 

[17] 3GPP TS 24.302: "Access to the 3GPP Evolved Packet Core (EPC) via non-3GPP access 

networks; Stage 3". 

[18] IETF RFC 5026 (October 2007): "Mobile IPv6 Bootstrapping in Split Scenario". 



Definitions and abbreviations 



3.1 Definitions 

For the purposes of the present document, the terms and definitions given in 3GPP TR 21.905 [1] and the following 
apply. 

Home Agent: The HA functionality consists in the DSMIPv6 anchor point functionality described in draft-ietf-mext- 
nemo-v4traversal [10] and IETF RFC 4877 [8]. Based on 3GPP TS 23.327 [2] the HA functionality may be 
implemented as a stand-alone entity, or collocated with the GGSN or the PDG. 

HI: This is the reference point for signalling and user data transfer between UE and HA. 

For the purposes of the present document, the following terms and definitions given in 3GPP TS 24.303 [3] apply: 

Home Network Prefix 

3.2 Abbreviations 

For the purposes of the present document, the abbreviations given in 3GPP TR 21.905 [1] and the following apply. An 
abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in 
3GPP TR 21.905 [1]. 

DSMIPv6 Dual-Stack MIPv6 

HA Home Agent 

HNP Home Network Prefix 

IKEv2 Internet Key Exchange version 2 

PDG Packet Data Gateway 



4 General 

4.1 Overview 

This specification defines the solution to handle the mobility between 3 GPP I-WLAN and GPRS systems. Such solution 
relies on DSMIPv6 protocol which is specified in draft-ietf-mip6-nemo-v4traversal [10] and IETF RFC 3775 [12] and 
is used to model the HI reference point between the UE and the HA function. The HI reference point enables the UE to 
handover from 3 GPP I-WLAN towards GPRS systems, and vice- versa, and granting session continuity by means of a 
DSMIPv6 signalling and an IP tunnel between UE and HA functions. This specification specifies only the procedures 
which are specific to I-WLAN mobility scenarios and relies on 3 GPP TS 24.303 [3] for DSMIPv6 procedures. In this 
specification, DSMIPv6 signalling is secured as specified in IETF RFC 4877 [8]: IKEv2 exchange is performed by the 
UE with the HA before tunnel establishment. The details of the security aspects are specified in 3GPP TS 33.402 [14]. 
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4.2 Identities 

As identification towards the HA, the UE shall use the same identities as described in 3GPP TS 24.303 [3]. To identify 
the desired HA, the UE shall use the HA-APN as specified in 3GPP TS 24.303 [3]. 

The UE shall use the same identities as specified in 3GPP TS 24.008 [4] to access GPRS systems. 

The UE shall use the same identities as specified in 3GPP TS 24.234 [5] to access 3GPP I-WLAN. 



5 I-WLAN mobility procedures 

5.1 Initial attach 

5.1.1 General 

The attach procedure is performed by the UE when connecting to GPRS systems or to 3 GPP I-WLAN. After 
completion of the attach procedure, HI PDN attach may be performed. Through HI PDN attach, the UE receives all the 
required parameters and information enabling the continuity of the session. The information is retrieved through the 
following procedures: 

- Discovery of the home agent address: the UE needs to discover the IPv6 address and eventually the IPv4 
address of the HA. 

- Security association estabhshment: if not on its home link, the UE needs to establish IPsec security 
associations with the HA in order to secure the DSMIPv6 signalling as specified in 3GPP TS 33.402 [14]. 
IKEv2, defined in IETF RFC 4877 [8], is used to establish IPsec security association. 

- IPv6 home network prefix assignment and home hnk detection: the UE needs to be assigned an IPv6 
Network Prefix of its home network in order to configure a global unicast home address to be used in DSMIPv6 
and to perform the home link detection. 

- IPv4 home address assignment: optionally, a dual-stack UE can also request to be assigned an IPv4 home 
address to be used for example for IPv4-only applications. 

- Initial binding registration: unless the home link detection procedure indicates the UE is at home, the UE 
sends a Binding Update message to perform its initial registration with the HA. 

5.1.2 UE procedures 
5.1.2.1 General 

When connecting to GPRS systems, the UE shall perform the GPRS attach procedure and establish a PDP context as 
described in 3GPP TS 24.008 [4]. During the PDP context activation procedure, the UE may request the HA IP 
address(es) and the Home Network Prefix. If the home network prefix is pre-configured or obtained from the GGSN, 
the UE shall perform the home link detection procedure as described in subclause 5.1.2.4. If the UE is on its home link, 
the UE shall not perform the HI PDN attach. If the UE is not on the home link or does not have a HNP yet, the UE shall 
discover the HA address as described in subclause 5.1.2.2 if the UE does not have the HA address, and then shall 
perform the HI PDN attach procedure. 

When connecting to the 3 GPP I-WLAN, the UE shall perform the I-WLAN attach procedure as described in 
3GPP TS 24.234 [5]. During the tunnel setup to the PDG, the UE may request a HA IP address or a HNP, or both, as 
described in annex B. If the home network prefix is pre-configured in the UE or obtained from the PDG as described in 
annex B, the UE shall perform the home link detection procedure as described in subclause 5.1.2.4. If the UE is on its 
home link, the UE shall not perform the HI PDN attach. If the UE is not on the home link or does not have a HNP yet, 
the UE shall discover the HA address as described in subclause 5.1.2.2 if the UE does not already have the HA address, 
and then perform the HI PDN attach procedure. 

The HI PDN attach procedure involves the following tasks: 
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- IPsec security associations' establishment and IPv6 home network prefix assignment; 

- home Hnk detection, if this procedure was not performed during the attachment; and 

- initial binding registration if the UE is not at its home link. 

5.1 .2.2 Discovery of the Home Agent address 

The first procedure the UE needs to perform for DSMIPv6 initial attach is the discovery of the node acting as the HA. 
The UE discovers the IPv6 address and optionally the IPv4 address of the HA in one of the three following ways: 

- via DNS as defined in 3GPP TS 24.303 [3] ; 

during the PDP context activation procedure in GERAN or UTRAN accesses via the Protocol Configuration 
Options as defined in 3GPP TS 24.008 [4] if the HA IP address is available in the GGSN; or 

- via IKEv2 during tunnel setup with PDG for 3 GPP I-WLAN as defined in annex B if the HA IP address is 
available in the PDG. 

If the HA IP address(es) are available in the GGSN, the GGSN shall return the HA IP address(es) in the Protocol 
Configuration Options during the PDP context activation procedure when attaching to the GERAN or UTRAN 
accesses. If the HA IP address(es) are not available in the GGSN, the UE shall discover the HA IP address(es) by DNS 
if the UE wants to perform the handover to 3 GPP I-WLAN. 

If the UE requests the HA IP address(es) during the IPsec tunnel setup to PDG in 3GPP I-WLAN connection and if the 
HA IP address(es) are available in the PDG, the PDG shall return the HA IP address(es) in IKEv2 configuration 
payload attributes as defined in annex B. If the HA IP address(es) are not available in the PDG, the UE shall discover 
the HA IP address(es) by DNS before performing the HI PDN attach. 

The UE shall support the HA discovery based on DNS and on Protocol Configuration Options. The UE may support the 
HA discovery based on IKEv2. 

The HA IP address(es) may also be pre-configured in the UE. 

5.1 .2.3 Security association establishment and IPv6 home network prefix assignment 

The UE shall perform the security association establishment with the HA as specified in 3GPP TS 24.303 [3]. For this 
procedure the UE shall support IKEv2 protocol and EAP over IKEv2 as described in IETF RFC 4306 [9]. The detailed 
procedure and supported extensions for this step are specified in 3GPP TS 24.303 [3]. The UE may use either EAP-SIM 
or EAP-AKA for authentication purposes. 

During the IKEv2 exchange, the UE shall request an IPv6 home network prefix as specified in 3GPP TS 24.303 [3]. 
The UE shall then auto-configure an IPv6 home address from the received prefix and create child SA as specified in 
3GPPTS 24.303 [3]. 

In the IKEv2 signalling the UE should indicate the target PDN the UE wants to connect to in the IDr payload as 
specified in 3GPP TS 24.303 [3]. 

5.1 .2.4 Home link detection 

The DSMIPv6 home link detection function is used by the UE to detect if, for a specific PDN, an access interface is on 
the home link from DSMIPv6 perspective. The home link detection function for a specific PDN connection shall be 
performed whenever the UE receives a new IPv6 prefix, either at initial attach or after a handover. 

The UE is informed of the IPv6 prefix associated with a specific access interface. If the UE is connected to GPRS 
systems, the UE knows the IPv6 prefix via the IPv6 address autoconfiguration as described in 3GPP TS 29.061 [6]. If 
UE is connected to the 3GPP I-WLAN, it knows the IPv6 prefix via IPv6 address autoconfiguration as described in 
3GPPTS 29.161 [7]. 

In the scenarios considered in this specification, the Home Network Prefix associated to the PDN connection can be 
assigned: 

- via Protocol Configuration Options from the GGSN in GPRS systems as specified in 3GPP TS 24.008 [4]; 
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via IPsec security associations bootstrap with the PDG in I-WLAN as specified in annex B; 

via the establishment of IPsec security associations with the HA as specified in 3GPP TS 24.303 [3] 
subclause 5.1.2.2; or 

the HNP may also be pre-configured in the UE. 

The home link detection procedure performed by the UE is specified in 3GPP TS 24.303 [3]. 

If the UE detects it is in the home link for this specific PDN over the access interface, the UE shall not perform the HI 
PDN attach. If the UE detects it is not on the home link, the UE shall perform IKEv2 procedure for security associations 
setup and IPv6 prefix and optionally IPv4 HA assignment if the UE does not have a valid security association with the 
HA, and then the UE shall send a Binding Update as specified in 3GPP TS 24.303 [3]. 

5.1 .2.5 Initial binding registration and IPv4 home address assignment 

After establishing the security association and obtaining the IPv6 home network prefix and after performing the home 
link detection, if not on the home link, the UE shall send a Binding Update message as specified in 3GPP TS 24.303 [3] 
to register its IPv6 home address with its care-of address. 

The UE may also request in the Binding Update an IPv4 home address based on the procedure specified in 
3GPPTS 24.303 [3]. 

5.1 .3 Network procedures 

5.1 .3.1 GPRS systems aspects 

During the PDP context activation procedure in GERAN or UTRAN accesses, if the HA IP address(es) and the HNP 
are available in the GGSN, the GGSN shall provide them to the UE via the Protocol Configuration Options as defined 
in3GPPTS24.008[4]. 

5.1 .3.2 3GPP I-WLAN aspects 

During the IPsec tunnel establishment, if the UE requests the HA IP address(es) or the HNP, or both, and if they are 
available in the PDG, the PDG shall provide them to the UE via the dedicated IKEv2 attributes as defined in annex B. 
The HA IP address(es) are referred to the W-APN for which the IPsec tunnel is set-up and which was inserted in the 
"IDr" payload of the IKE_AUTH request message to the PDG. 

5.1.3.3 HA procedures 

5.1 .3.3.1 Security association establishment and IPv6 home network prefix assignment 

The HA shall support the IKEv2 protocol and EAP over IKEv2 as described in IETF RFC 4306 [9] . The HA procedures 
for security association establishment and IPv6 home network prefix assignment are specified in 3GPP TS 24.303 [3]. 

5.1 .3.3.2 Initial binding registration and IPv4 home address assignment 

The HA procedures for initial binding registration and IPv4 home address assignment are specified in 
3GPPTS 24.303 [3]. 

In addition, if the HA has the GGSN APN information, the HA shall send the APN to the UE in the Binding 
Acknowledgement message using the 3GPP Vendor-Specific Access Point Name as specified in annex A. 

5.2 Handover 
5.2.1 General 

The handover procedure is performed by the UE when it is moving from GERAN or UTRAN accesses to 3 GPP I- 
WLAN and vice- versa. 
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5.2.2 Handover from GPRS systems to 3GPP l-WLAN 

5.2.2.1 UE procedures 

When the UE is connected to the GPRS systems and wants to move to 3 GPP I-WLAN, the UE shall initiate the tunnel 
establishment procedure towards the PDG as described in 3 GPP TS 24.234 [5] and shall then perform the home link 
detection as described in subclause 5.1.2.4: 

- If the UE is not on the home link and does not know the HA IP address, it shall perform the HA discovery 
procedure as specified in subclause 5.1.2.2 and then perform the HI PDN attach procedure with the HA. If the 
UE already knows the HA IP address but has not established security associations with the HA, the UE shall 
perform the HI PDN attach with the HA after the attachment to the 3GPP I-WLAN. If available, the UE shall 
provide its IPv6 Home Address to the HA during the IKE_AUTH request message in the configuration payload 
INTERNAL_IP6_ADDRESS as described in IETF RFC 5026 [18]. If the UE has already a vaHd binding at the 
HA, the UE shall send a Binding Update message to inform the HA of its new Care-of- Address, as specified in 
3GPP TS 24.303 [3]. During the handover, the UE keeps using the GERAN or UTRAN accesses. 

- If the UE is on the home link, the UE shall send a Binding Update with lifetime set to to remove the binding at 
the HA as specified in 3GPP TS 24.303 [3]. 

Once the handover is completed, the UE should deactivate the PDP context and may initiated a detach procedure in the 
GPRS system. 

5.2.2.2 Network procedures 

5.2.2.2.1 3GPP I-WLAN aspects 

Once the UE is connected to the 3GPP I-WLAN and if the UE is on the home link for the PDN connection, the 3GPP I- 
WLAN shall ensure that the UE obtains the IP address, which is the same as the Home Address, during the 
establishment of the IPsec tunnel with the PDG. 

5.2.2.2.2 HA aspects 

Upon receiving of the Binding Update message from the UE, the HA shall behave as described in 3GPP TS 24.303 [3]. 

5.2.3 Handover from 3GPP I-WLAN to GPRS systems 
5.2.3.1 UE procedures 

When the UE is connected to the 3GPP I-WLAN and wants to move to GPRS systems, the UE shall perform the attach 
and PDP context activation procedures as described in 3GPP TS 24.008 [4]. The APN provided by the UE in the PDP 
context activation procedure is used by the SGSN to allocate the GGSN. When the HA and the GGSN are collocated, 
the UE shall be connected to the GGSN that contains the HA function allocated in 3GPP I-WLAN. For that purpose, the 
UE shall use the received APN in the Binding Acknowledgement message during HI PDN attach for performing the 
PDP context activation procedure. If no APN is received in the Binding Acknowledgement message during HI PDN 
attach, the UE shall use the pre-configured APN, if available, for performing the PDP context activation procedure. 

Once the UE is attached to the GPRS system and after performing the PDP context activation procedure, it will receive 
a new PDP address as a Care-of- Address. The UE shall then perform the home link detection procedure as specified in 
subclause 5.1.2.4: 

- If the UE is not in the home link and does not know the HA address, the UE shall perform the HA address 
discovery procedure as specified in subclause 5.1.2.2 and then perform the HI PDN attach procedure with the 
HA. If the UE already knows the HA address but does not have a valid binding at the HA, the UE shall perform 
the HI PDN attach procedure with the HA after the attachment to the GPRS system. If the UE has already a 
valid binding at the HA, the UE shall send a Binding Update message as specified in 3GPP TS 24.303 [3]. 

If the UE is on the home link, the UE shall send a Binding Update with lifetime set to to remove the binding at 
the HA as specified in 3GPP TS 24.303 [3]. 

Once the handover is completed, the UE should initiate tunnel disconnection from the 3 GPP I-WLAN. 
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5.2.3.2 Network procedures 

5.2.3.2.1 GPRS systems aspects 

Once the UE is connected to the GPRS system and if it is on the home Hnk for a PDN connection, the GPRS system 
shall ensure that the UE keeps the same Home Address during the PDP context activation procedure. 

5.2.3.2.2 HA aspects 

Upon receiving of the Binding Update message from the UE, the HA shall behave as described in 3GPP TS 24.303 [3]. 

5.3 Detach 

5.3.1 General 

The DSMIPv6 detach is performed by the UE to tear down the IP tunnel between the UE and the HA and the respective 
IKEv2 session or by the network to inform the UE that it does not have access to a specific PDN through DSMIPv6 any 
longer. After the detach procedure, the UE still has IP connectivity provided by the access network. 

5.3.2 UE procedures 

5.3.2.1 Network-initiated detach 

The network-initiated detach is based on the usage of the Binding Revocation Indication (BRI) message. When the UE 
receives a BRI, it shall proceed as described in 3GPP TS 24.303 [3]. 

5.3.2.2 UE-initiated detach 

To detach from a specific PDN to which it is connected through a DSMIPv6 session, the UE shall de -register the 
DSMIPv6 binding and tear down the IPsec security association as specified in 3GPP TS 24.303 [3]. 

5.3.3 Network procedures 

5.3.3.1 GPRS systems aspects 

Network detachment of the UE connected to GPRS systems is performed as described in 3GPP TS 24.008 [4]. This 
procedure is independent from HI reference point procedures. 

5.3.3.2 3GPP l-WLAN aspects 

Network detachment of the UE connected to a 3GPP I-WLAN is performed as described in 3GPP TS 24.324 [5]. This 
procedure is independent from HI reference point procedures. 

5.3.3.3 HA aspects 

Once the HA receives a trigger for network-initiated detach procedure or a Binding Update with lifetime field set to 0, 
the HA shall proceed as described in the Dual-Stack Mobile IPv6 detach procedure in 3GPP TS 24.303 [3]. 

5.4 Protection of DSMIPv6 tunnel traffic 
5.4.1 General 

UE and HA may create a child security association using the IKEv2 session established as described in 

subclause 5.1.2.3. This child security association is used to cipher or integrity protect, or both, all data traffic exchanged 



ETSI 



3GPP TS 24.327 version 8.1 .0 Release 8 13 ETSI TS 124 327 V8.1 .0 (2009-03) 

within the DSMIPv6 tunnel. The procedure is initiated by the HA and may be initiated at any time after the security 
association between UE and HA has been set up. The support of this procedure is optional for both the HA and the UE. 

5.4.2 UE procedures 

When the UE receives a CREATE_CHILD_SA request from the HA with selectors indicating the DSMIPv6 tunnel 
traffic, the UE should reply with a CREATE_CHILD_SA response selecting the preferred transform proposed by the 
HA as specified in IETF RFC 4306 [9]. 

If the child S A is created successfully, the UE shall start ciphering or integrity protecting, or both, all the uplink packets 
in the DSMIPv6 tunnel as negotiated with the HA during the CREATE_CHILD_SA procedure. 

The UE may stop ciphering or integrity protecting, or both, the DSMIPv6 tunnel traffic. In order to do that, the UE shall 
delete the respective child security association by sending an INFORMATIONAL request message including the 
DELETE payload as specified in IETF RFC 4306 [9]. The protocol ID shall be set to 3 in order to indicate that only the 
ESP SA shall be removed. 

5.4.3 HA procedures 

After establishing the IPsec security association with the UE as described in subclause 5.1.3.3, the HA may optionally 
trigger the creation of a child security association to protect the traffic send via the DSMIPv6 tunnel. 

In order to activate the protection of DSMIPv6 tunnel traffic, the HA shall initiate the creation of a child security 
association sending a CREATE_CHILD_SA request message to the UE. In the CREATE_CHILD_SA message the HA 
shall request for an ESP security association; the HA shall also set the S A payload depending if integrity protection or 
ciphering, or both, are needed as described in IETF RFC 4306 [9]. The traffic selectors shall be set as described in 
subclause 5.2.4 of IETF RFC 3776 [11]. 

If the child security association is created successfully, the HA shall start ciphering or integrity protecting, or both, all 
the downlink packets in the DSMIPv6 tunnel as negotiated with the UE during the CREATE_CHILD_SA procedure. 

At any time the HA may stop ciphering or integrity protecting, or both, the DSMIPv6 tunnel traffic. In order to do that, 
the HA shall delete the respective child security association by sending an INFORMATIONAL request message 
including the DELETE payload as specified in IETF RFC 4306 [9]. The protocol ID shall be set to 3 in order to indicate 
that only the ESP SA shall be removed. 
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Annex A (normative): 
Message details 

A.1 General 

The DSMIPv6 messages described in annex A of 3GPP TS 24.303 [3] are applicable to this specification. Additional 
mobility option(s) and message(s) are described in this section which is also applicable for the mobility between 3GPP 
I-WLAN and GPRS systems. 

A.2 I-WLAN Mobility Specific DSMIPv6 Information 
Elements 

A.2.1 General 

This specification requires the encoding of additional I-WLAN Mobility Specific Information Elements for DSMIPv6 
with the 3GPP Mobile IPv6 Option, as defined by 3GPP TS 29.282 [16]. The I-WLAN Mobility Specific Information 
Elements defined by this specification are listed in the table A.2. 1-1. 



Table A.2.1 -1: I-WLAN Mobility Specific DSMIPvG Information Elements 



I-WLAN Mobility Specific 

DSMIPv6 Information 

Elements 


I-WLAN Mobility Specific DSMIPv6 Information 
Elements description 


I-WLAN Mobility Access Point 
Name (APN) 


Subclause A.2.2 



The subtype for an I-WLAN Mobility Specific DSMIPv6 Information Element shall be reserved in 
3GPP TS 29.282 [16]. The data format of the I-WLAN Mobility Specific DSMIPv6 Information Element shall be 
defined in this specification. If the data format is defined by another specification, that specification shall be referenced 
in the table above. 

A.2.2 I-WLAN Mobility Access Point Name (APN) 

The purpose of the I-WLAN Mobility APN Information Element is to carry an APN if the HA is collocated with the 
GGSN. The APN is used by the UE when handover is performed from 3GPP I-WLAN to GPRS. 

The 3GPP Vendor-Specific Vendor Specific Access Point Name IE is described in figure A.2. 1-1 below: 

Bits 
Octets 8 7 6 5 4 3 2 1 



1~n I Access Point Name (APN) | 

Figure A.2.1 -1 : 3GPP Vendor-Specific Access Point Name (APN) 
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Annex B (normative): 

IKEv2 Configuration Payload attributes 

B.1 General 

When connecting to 3 GPP I-WLAN, the UE may request the Home Agent IP address(es) or the Home Network Prefix, 
or both, by including the corresponding attributes in an IKE_AUTH request message Configuration Payload of type 
CFG_REQUEST as described below. 

Upon receipt of an IKE_AUTH request message containing a request for HA IP address(es) or HNP, or both, and after 
authorization and authentication with the 3GPP AAA server as described in 3GPP TS 24.234 [5], and if available in the 
PDG, the PDG shall provide to the UE at least one of: 

- the HA IPv6 address and optionally the HA IPv4 address in the IKE_AUTH response CFG_REPLY 
Configuration Payload as specified in 3GPP TS 24.302 [17]; or 

- the IPv6 HNP as described in the HNP attribute is defined as MIP6_H0ME_PREFIX attribute as described in 
IETF RFC 5026 [18]. 

When the UE wants to have other PDN connections through the same PDG, the UE may discover the HA IP address(es) 
using DNS as defined in 3GPP TS 24.303 [3]. 
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